JPH09230787A - Encoding method and device therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To encode long plaintext by using an encoding procedure intended for a short block by forming code from the encoded part where the masked plaintext block is encoded and the remaining parts. SOLUTION: The key block 110 in the encoding procedure 100 is first 'masked'. Namely, the key block is converted to the masked key block 130 of the same size by using a masking procedure 120. Next, part 131 of the masked key block 130 is encoded by using the encoding procedure 140 having the encoding key 141, by which the encoded part 151 of the code block 150 is formed. The code block 150 is thus formed of the part where the masked plaintext block is encoded and the remaining parts of the masked plaintext block. The code block 150 is transmitted to a signal receiver. The signal receiver restores the code block to the original plaintext block by reverse tracing the procedures 140, 120, 100.

Description

Detailed Description of the Invention

[0001]

FIELD OF THE INVENTION This invention relates to block cipher systems and, more particularly, to a method and apparatus for encrypting long plaintext blocks using an encryption procedure intended for relatively short blocks.

[0002]

Cryptographic schemes fall into two general categories: symmetric and asymmetric cryptographic systems. Those that comply with the data encryption standard (DES),
In a symmetric encryption system, the recipient uses the same key that the sender used to encrypt the data (ie, convert plaintext to ciphertext) and the recipient decrypts the same data (ie, ciphertext to plaintext). Turn it back). Symmetric encryption schemes can often be implemented very efficiently, but have the disadvantage that the encryption keys have to be exchanged in advance over a secure communication channel.

Asymmetric cryptographic systems, or systems commonly referred to as public key cryptographic systems, use one key to encrypt data and another key to decrypt the same data. In a public key encryption system, the intended recipient of the data creates a key pair consisting of a publicly available encryption key and a decryption key that is kept secret and not shared with others. These keys are created in such a way that the private key cannot be derived from the knowledge of its corresponding public key. Therefore, a ciphertext message created using the public key can only be decrypted by the intended recipient with the private key. An important advantage of public key cryptography over symmetric systems is that private key information does not have to be exchanged. Establish secure two-way communication by exchanging public keys created by both parties. For this reason, asymmetric cryptosystems are often used for the private key exchanges required in symmetric cryptosystems.

The most well known public key cryptosystem will be the RSA cryptosystem, named after the developer. Regarding this, R. L. Rivest and other papers "A Method for Obtaining Digit
al Signatures and Public-KeyCryptosystems "(Commu
nications of the ACM, vol.21, no.2, pp.120-126, 19
78). RSA encryption systems typically have about 512 bits of encrypted blocks and can be very computationally intensive. However, recently, so-called elliptic curve systems have been developed by N. Koblitz's "Elliptic Curve Cryptosystems" (Mathematics of C
omputation, vol.48, no.177, pp.203-209, Jan. 198
7) and A. Menezes 「Elliptic Curve
It is described in reference materials such as "Public Key Cryptosystems" (1993). Like the RSA encryption system, the elliptic curve system is a public key system that uses a public encryption key and a secret decryption key. Elliptic curve systems typically have relatively short keys and cipher block sizes, each on the order of 160 bits, but cipher strength is greater for blocks of R
It is comparable to the SA encryption system. Therefore, elliptic curve systems are an attractive combination of cryptographic strength and computational efficiency.

[0005]

Since the elliptic curve cryptosystem is a public key system, one use for such a system would be key distribution. Therefore, user A
Encrypts the symmetric key (eg, DES key) using the public elliptic curve key for distribution to user B. But,
A problem arises because the symmetric key is typically contained in a key block (e.g., 512-bit block) that is much longer than the elliptic curve encryption block of about 160 bits, as described above. Although the key block can be split into multiple cipher blocks of sufficiently small size, the additional cryptographic operations required for each cipher block provide the inherent advantage of an elliptic curve system in terms of computational efficiency. It is damaged to some extent. What is needed is a method of key encryption that can be used with an elliptic curve algorithm that allows large key blocks to be encrypted using a much shorter secret elliptic curve key.

[0006]

One aspect of the present invention is to encrypt a plaintext block (such as a key block) using a block cipher algorithm (such as an elliptic curve algorithm) that has a block size smaller than the plaintext block. Intended for a system that does. According to this aspect of the invention,
Convert the plaintext block to a masked plaintext block, optionally using a lossless transformation that depends on additional data outside the plaintext block. This additional data may include control information, control vectors, or other information that is available to the recipient and does not require encryption. In this conversion, (1) the original plaintext block can be restored from the masked key block and optional additional information, and (2)
Each bit of the masked plaintext block is defined to depend on every bit of the original plaintext block. Encrypt a portion of the masked plaintext block using an encryption algorithm to produce an encrypted portion of the masked plaintext block. A ciphertext block is generated from the thus encrypted part of the masked plaintext block and the rest of the masked plaintext block. This ciphertext block is sent to the recipient, who then reverses this procedure to recover the original plaintext block.

The rest of the masked plaintext block is non-encrypted because it is necessary to reconstruct the entire masked plaintext block into the original plaintext block and because the encrypted part cannot be derived from the rest. It can be sent to the recipient in encrypted form. Thus, the present invention allows long key blocks to be encrypted using short encryption keys. In one embodiment, using an elliptic curve algorithm with a block size on the order of 160 bits,
Encrypt a 512-bit block containing a symmetric encryption key.

In accordance with another aspect of the present invention, both plaintext blocks and optionally additional data upon which the transformation relies, use increment counters, time stamps, random numbers, or other mechanisms to Each encryption can be uniquely modified to prevent certain cryptanalysis attacks.

[0009]

DETAILED DESCRIPTION OF THE INVENTION FIG. 1 illustrates a general encryption procedure 100 of the present invention. Depending on the particular embodiment,
The functional blocks illustrated in FIG. 1 and elsewhere may be hardware elements, software code, or some combination of the two. As is customary, "software code" means a program of instructions that resides on a machine-readable program storage device (magnetic disk or optical disk) that can be executed by a machine (such as a server or client workstation) to carry out the described method means. Means The machine and program storage for such software implementations are quite conventional and therefore not shown.

The encryption procedure 100 has as input data a long plaintext block, such as the key block 110 shown. In general, the key block 110 can be composed of any desired data such as a symmetric encryption key. However, the key block 110 must contain a secret value (eg, secret DES key or secret random number) of sufficient length to prevent exhaustion and to prevent adversaries from following the masking procedure described below. . For the sake of explanation, it is assumed that this secret value has enough independent bits, eg 128 bits, to prevent exhaustive attacks to find it. However, the present invention does not contemplate a particular number of bits for this secret value.

Key block 110 contains certain fixed bits required for the encryption process (eg, setting the high-order bit to zero) or certain fixed bits (eg, using delimiter bytes) for parsing algorithms. You can also However, the key block 110 also preferably includes other fixed or predictable bits used for non-muggability. These bits can be used to verify that the key block was successfully restored.

FIG. 5 shows possible formats for the key block 110. The key block 110 contains a first field 50 containing fixed information for verifying the restoration process.
1, a second field 502 containing the symmetric encryption key or other secret information to convey to the recipient, and a counter 504 that increments (505) with each encryption of a plaintext block.
Optional third field 5 with count from
Including 03.

The count field 503 ensures that the key block 110 is unique for each encryption of the plaintext block. Randomly generated numbers can be used for similar purposes, but the use of counts deterministically prevents the same key block 110. Random numbers, on the other hand, only provide the probability of preventing the same key block. Instead of having the count in the key block 110 itself, it is also possible to insert the count in an additional data field that is external to the key block upon which the masking transformation optionally depends, as described below.

Referring again to FIG. 1, in the encryption procedure 100 the key block 110 is first “masked”. That is, it is transformed into a masked key block 130 of the same size using masking procedure 120. Although details of the masking procedure 120 will be described later, the masking procedure is a reversible transformation defined to have the following ciphertext properties. 1. Each bit of the masked key block 130 is a function of every single bit in the key block 110 (ie, there is strong intersymbol independence). 2. Which key block 110, unless all bits in the masked key block 130 are known or available (unless the adversary can exhaust the unknown bits in the masked key block) The bit cannot be discriminated either.

The masked key block 130 produced by the masking procedure 120 having the above characteristics is of any length as long as the key length is long enough to deter a try-and-play type attack. It can be protected by encrypting a part.

The portion 131 of the masked key block 130 is then encrypted using the encryption procedure 140 with the encryption key 141 to produce the encrypted portion 151 of the ciphertext block 150. Encryption procedure 14
0 is a 160-bit key (and encryption block)
It is preferably a public key procedure such as an elliptic curve procedure with size. Details of the elliptic curve procedure used do not form part of the present invention but are set forth in the references cited above. The elliptic curve procedure is highly preferred because of its high cryptographic strength for its block size, but generally any other public key procedure or secret key procedure such as DES should be used in place of the encryption procedure 140. You can

The remaining portion 152 of the ciphertext block can simply be taken from the corresponding portion 132 of the masked plaintext block 130 without encrypting it. Alternatively, the remaining portion 13 of the masked key block 130
All or part of two may also be encrypted as one or more blocks or parts using one or more keys and one or more encryption algorithms. Again, one or more keys and one or more encryption algorithms may be used to variously encrypt the same data according to an encryption pipeline.

A masking procedure 120 is shown in FIG. The masking procedure starts with key block 1
10 for the first part 202 (part A) and the second part 204
Divide into (part B). Although part A is shown to the left of part B in the figure, any other scheme for allocating bits to the two parts can be used. The order and location of bits is not important. Parts A (202) and B
The lengths of (204) may be equal or different. However, it is advantageous in security to make the lengths of the portions 202 and 204 equal or nearly equal.

At least one of the portions 202, 204
One of them contains a secret value such as a secret key or secret random number. However, this secret value is partially
2 can be partly divided into parts 204.

In general, the masking procedure 120
Includes the following steps. 1. Part A (202) is masked with part B (204) to produce an intermediate part A (212). 2. Part B (204) is replaced by part A (21
The masked portion B (220) is generated by masking in 2). 3. Masked part B of intermediate stage part A (212)
Masked in (220) and finally masked part A
(228) is generated. 4. Optionally, masking is repeated further if desired or necessary (not shown).

To make each bit in the masked key block 130 a function of each block in the (unmasked) key block 110, masking must be repeated three times. Three proper iterations of masking should also be sufficient to make each bit in the masked key block 130 dependent on each bit in the original key block 110. This gives a complete inter-symbol dependency.

The masking procedure will be described in detail below. The masking procedure 120 is the first
Part B (204) using the generator function (G1) 206 of
A first mask value 208 (mask 1) is calculated for The length of the mask 1 (208) is equal to the length of the portion A (202).

Next, the mask 1 (208) is covered with the portion A (20
Combined with 2) (210) Intermediate part A (212)
Generate This join operation 210 can be an exclusive OR (XOR), that is, bit-wise modulo-2 addition as shown. Specifically, the join operation 210
Can include any lossless operation, such as modulo addition for n-bit blocks.

Next, a second mask value 216 (mask 2) is calculated for the intermediate stage portion A (212) using the second generator function 214 (G2). Mask 2 (21
The length of 6) is equal to the length of part B (204). Exclusive OR (2 if mask 2 (216) and part B (204)
18) is taken to produce the masked portion B (220).

Finally, the third mask value 224 (mask 3) is calculated for the masked portion B (204) using the third generation function 222 (G3). Mask 3 (2
The length of 24) is equal to the length of part A (202). Exclusive-OR (226) mask 3 (224) with intermediate stage portion A (212) to produce the final masked portion A (228).

Each of the generation functions G1 to G3 is a ciphertext one-way function that calculates an n-bit output value from an m-bit input value (where m and n are input variables to the generation function). A "one-way" function, in the sense conventionally used in cryptography, is a function that by its inverse cannot calculate almost any output value of that function.
One possible implementation of the generator functions G1-G3 is FIPS Publi
NIST Secure Hash Algorithm Revision 1 (SHA-1), described in caion 180-1 Secure Hash Standard (SHS), RLRevest “The MD5
RSA Message Digest Algorithm 5 (MD5) described in "Message Digest Algorithm" (RFC 1321, Apr. 1992), or the IBM Modified Detection Code Algorithm (MDC- Would use a strong cryptographic hash function H such as 2/4).

In the following example, MD5 for generating a 128-bit hash value is used for the hash function H. As a premise for simplification, parts 202 and 2
The length of 04 is assumed to be a multiple of 128 bits (16 bytes). Further, for purposes of explanation, part A (202)
Consists of three 16-byte blocks, part B (20
4) shall consist of two 16-byte blocks.

Referring to FIG. 3, the first mask value 208
(Mask 1) is calculated using function G1 (206) as follows. 1. The eigenvalue 302 (value 1) is concatenated with the part B (204) and the resulting value is hashed using H (308) to obtain the 128-bit value 314 (X1). 2. The eigenvalue 304 (value 2) is concatenated with the part B (204) and the resulting value is hashed using H (310) to obtain the 128-bit value 316 (X2). 3. The eigenvalue 306 (value 3) is concatenated with the part B (204) and the resulting value is hashed using H (312) to obtain the 128-bit value 318 (X3).

Mask 1 (208) has the values 314, 31.
6, 318 (X1 to X3) are defined as concatenations. The length of the mask 1 (208) is the same as the length of the portion A (202) used for the exclusive OR with it, which is 3 × 1.
6 = 48 bytes.

Referring to FIG. 4, function G2 (214) is used to calculate the second mask value 216 (mask 2) as follows. 1. The eigenvalue 402 (value 4) is set to the intermediate part A (21
2) concatenate and hash the resulting value using H (406) to get the 128-bit value 410 (X4). 2. The eigenvalue 404 (value 5) is set to the intermediate part A (21
Concatenate with 2) and hash the resulting value using H (408) to get the 128-bit value 412 (X5).

Mask 2 (216) has the values 410, 412.
It is defined as a concatenation of (X4 to X5). Mask 2 (2
The length of 16) is the part B obtained by exclusive OR with that.
The same as the length of (204), 2 × 16 = 32 bytes.

In the illustrated embodiment, the function G3 (222) is the same as the function G1 (206) and the only difference between the two functions is that the function G3 has its input value unmasked in part B (204). ) Instead of the masked part B (22
It is to receive from 0). This is merely for efficiency of implementation, but in general G3 differs from G1.
Also, function G2 is different than functions G1 and G3, but only because the lengths of portions 202 and 204 are different. If the two parts have the same length, these functions G
1 to G3 can all be the same.

The values 302-306 and 402-404 are different from each other, but can remain the same for each invocation of the functions G1-G3. Alternatively, an incremental counter or other suitable mechanism may be used to change each of these values on each successive invocation of the generate function.

If the value of the portion 202 or 204 is not a multiple of the length of the hash function H (16 bytes in the above example), it is (1) a multiple of the length of the hash function H, and (2)
Calculate a mask value that is longer than the data you want to mask. In that case, the exclusive OR of a part of the mask and the input data is taken. It may be necessary to pad the input data before hashing the data. However, this has no substantial effect on the design of the generating function.

Referring to FIG. 6, the procedure 600 used to recover the original key block from the ciphertext block 150.
Is shown. The procedure 600 is the decryption procedure 61.
The encrypted portion 151 of the ciphertext block 150 using 0
Decrypted and regenerated the masked key block 620
To generate a first portion 621 of Decryption procedure 61
0 is just the reverse of the encryption procedure 140. If the encryption procedure 140 is a public key procedure with the public encryption key 141, the decryption procedure 610
Is the corresponding private decryption key 611 known only to the recipient.
Having. If the encryption procedure 140 is a symmetric procedure, the decryption key 611 is the same as the (secret) encryption key 141. The remaining portion 622 of the reclaimed masked key block 620 is simply retrieved from the remaining portion 152 of the ciphertext block 150 without modification. The unmask procedure 630 then transforms the regenerated masked key block 620 into an unmasked key block 640 that matches the original key block 110.

An unmask procedure 630 is shown in FIG. This is just the reverse of the masking procedure 120. Procedure 630 first reconstructs the reconstructed masked key block 620 into portions 202 and 204.
(FIG. 2) and masked portions A corresponding in length to
(702) and part B (704). Procedure 630 then uses generator function G3 (706) to mask 3 (70) from masked portion B (704).
Play 8). Next, the mask 3 (708) is combined with the masked portion A (702) to regenerate (710) the intermediate portion A (712). Next, the generation function G2 (7
14) is used to generate mask 2 (716) from intermediate stage part A (712). Mask 2 (716) is combined with masked portion B (704) (718) to recreate the original portion B (720). Finally, the generation function G1
(722) is used to generate Mask 1 (724) from the original part B (720). Mask 1 (724) is combined (726) with intermediate stage part A (712) to produce the final unmasked part A (728).

Join operations 710, 718, and 726 are each operation 22 of masking procedure 120.
It is configured to be the reverse of 6, 218, and 210. In the illustrated embodiment, where the join operation in the masking procedure 120 is an XOR operation, the inverse join operations 710, 718, and 726 are also XOR operations.

When the functions G1 and G3 are the same as in this embodiment, the unmasking procedure 630 (FIGS. 6-7) is the same as the masking procedure 120 (FIGS. 1-4). That is, the masking procedure 120 is set to 2
The original output is obtained by applying it twice. However, this is a special case and generally masking
Procedure 120 is the reverse unmask procedure 63
May differ from zero.

Although there is data such as control information, an initialization vector or a count, which is desired to be associated with or combined with a key, there may be a situation where it is not desired to keep it in the key block itself. This can be done by adding the data or the hash of the data to one of the divided parts of the plaintext block and calculating the mask value for the expanded part. Otherwise, this method is as described above.

In FIG. 8, the part B (204) is added data.
A modified masking procedure 120 'is shown that computes modified mask 1 (208') by concatenating field 801 ("other data") to produce expanded portion B (204 '). Additional data
Field 801 is based on control information, an initialization vector, a count that increments with each successive encryption, or other information available to or available to the recipient. In the additional data field 801,
It can contain unmodified form of the information or be based on a hash function of such information. The additional data field 801 is shown as being added to the right of part B (204), although it is often preferred, but it can also be added to the left of part B (204). In response to the expanded portion B (204 '), the modified function G1 (2
06 ') produces a modified mask 1 (208'),
It is combined (210) with part A (204) to produce a modified intermediate stage part A (212 ').

Modified Masking Procedure 12
The rest of the 0'is the masking procedure 120 illustrated in FIG. 2 (other than receiving the modified input value).
The same and is therefore not shown. The unmasking procedure corresponding to this modified masking procedure 120 'is similar to the unmasking procedure 630, with the appropriate modification to take into account the additional data field 801.

In the modified masking procedure 120 'shown in FIG. 8, it is modified to make the masking value dependent on the additional data field 801 by modifying the first masking step (part A using part B Mask). However, alternatively, or in addition, either or both of the two subsequent masking steps may be modified to use the additional data field 801. Therefore, to rely on the extended key block part created by concatenating the original block part with the additional data field,
Either or both of the generation functions G2 (214) and G3 (222) can be modified. In the former case, the additional data field 801 would be concatenated with part A rather than part B to provide the input value to function G2.

This modification consists of masking the key block 13
0 has the advantage that it is a function of the extra data (or a hash of such data) in the additional data field 801 as well as the original key block 110.
However, this extra data is not part of the key block 110 itself and is therefore not masked.

As described above, either (or both) the key block 110 and the additional data field 801.
Must be unique for each plaintext block encryption. This can be accomplished by inserting a unique count in the key block 110 or the extra data field 801, or by using a time stamp, random number, or other mechanism as described above.

In summary, the following is disclosed regarding the configuration of the present invention.

(1) A method of encrypting a plaintext data block using a block encryption procedure having a block size smaller than the plaintext block, wherein each bit of the masked plaintext block is the original plaintext. Transforming the plaintext block into the masked plaintext block using a predetermined lossless transform defined to depend on each and every bit of the block; and the block using the encryption procedure. Encrypting a portion of the masked plaintext block having a size,
Generating an encrypted part of the masked plaintext block, and generating a ciphertext block from the encrypted part of the masked plaintext block and the rest of the masked plaintext block A method including steps and. (2) The method according to (1) above, further including the step of transmitting the ciphertext block to a recipient. (3) The method according to (1) above, wherein the ciphertext block is generated by encrypting the rest of the masked plaintext block. (4) The remaining portion of the masked block is
Being encrypted using an encryption procedure different from the encryption procedure used to encrypt the portion of the masked plaintext block,
The method according to (3) above. (5) The method according to (1) above, wherein the plaintext block is generated without encrypting the rest of the masked plaintext block. (6) The method according to (1) above, further including a step of restoring an original plaintext block from the plaintext block. (7) The restoring step includes a step of reproducing the masked plaintext block from the plaintext block,
The reproducing step includes the step of decrypting the encrypted part of the masked plaintext block, and the decompressing step reverses the predetermined transformation to recover the original masked plaintext block from the reproduced masked plaintext block. Characterized by including the step of playing a plaintext block of
The method according to the above (6). (8) The method according to (1) above, wherein the encryption procedure includes a symmetric encryption procedure having a public encryption key and a public decryption key. (9) The method according to (1) above, wherein the encryption procedure includes an elliptic curve procedure. (10) The plaintext block includes first and second parts, and the converting step uses the second part to mask the first part to generate an intermediate first part. Masking the second portion using the first portion of the intermediate stage to produce a masked second portion, and using the masked second portion Masking the intermediate first portion to produce a masked first portion, the first portion of the masked plaintext block using one of the masked portions. Is generated, and the other of the masked portions is used to generate a second portion of the masked plaintext block. (11) at least one of the masking steps concatenates one of the portions with additional data outside the key block to generate an extended portion; and Masking the other using the extended portion. (12) The masked first portion forms the first portion of the masked plaintext block, and the masked second portion forms the second portion of the masked plaintext block. The above (1
The method according to 0). (13) the plaintext block includes first and second parts, the converting step generating a first mask value from the second part using a first conversion; Combining the mask values of the first part with the first part to produce a first part of the intermediate stage, and using a second transform to generate a second mask value from the first part of the intermediate stage. Combining the first mask value with the second portion to produce a masked second portion, and using a third transform from the masked second portion. Generating a third mask value;
Of the mask values of the intermediate stage with the first portion of the intermediate stage to produce a masked first portion, the masked plaintext block using one of the masked portions. Is generated, and the other of the masked portions is used to generate a second portion of the masked plaintext block. Method. (14) The method according to (13) above, wherein the mask value is generated using a one-way function. (15) The method according to (13) above, wherein the combining step is performed by combining blocks of n bits using modulo addition. (16) The above-mentioned (15), wherein the combining step is performed by using modulo-2 addition in bit units.
The method described in. (17) The masked plaintext block is generated according to the plaintext block and the optional additional data, and the method is at least one of the plaintext block and the optional additional data for each encryption of the plaintext block. The method according to (1) above, further comprising the step of uniquely modifying the modified plaintext block. (18) A method for encrypting a plaintext block using a block encryption procedure, the original plaintext block being defined to be recoverable from the masked plaintext block and optional additional data. Generating a masked plaintext block according to the plaintext block and optional additional data using a reversible transform of at least a portion of the masked plaintext block using the encryption procedure. Encrypting to generate a ciphertext block, and uniquely modifying at least one of the plaintext block and the optional additional data before generating the masked plaintext block for each encryption of the plaintext block And a step of performing. (19) The method according to (18) above, wherein the plaintext block is uniquely modified before the generation of the masked plaintext block for each encryption of the plaintext block. (20) The method according to (18) above, wherein the additional data is uniquely modified before the generation of the masked plaintext block for each encryption of the plaintext block. (21) The method according to (18) above, wherein the at least one of the plaintext block and the optional additional data includes a count that increases with each encryption of the plaintext block. (22) The method according to (18) above, wherein the at least one of the plaintext block and the optional additional data includes a different time stamp for each encryption of the plaintext block. (23) The method according to (18), wherein the at least one of the plaintext block and the optional additional data includes a value randomly generated for each encryption of the plaintext block. . (24) A device for encrypting a plaintext data block using a block encryption procedure having a block size smaller than the plaintext block, wherein each bit of the masked plaintext block is one of the original plaintext block. Means for transforming the plaintext block into the masked plaintext block using a predetermined lossless transform defined to be dependent on every one bit, and having the block size using the encryption procedure Means for encrypting a portion of the masked plaintext block to produce an encrypted portion of the masked plaintext block; and the encrypted portion of the masked plaintext block and the masked portion. An apparatus including means for generating a ciphertext block from the rest of the plaintext block. (25) The plaintext block includes first and second parts, and the converting means uses the second part to mask the first part to generate an intermediate first part. Means and the second part using the first part of the intermediate stage
Means for masking a portion of the mask to produce a masked second portion, and the masked second portion is used to mask the first portion of the intermediate stage to mask the first portion. Generating a first portion of the masked plaintext block using one of the masked portions and using the other of the masked portions to generate the first portion of the masked plaintext block. Apparatus according to (24) above, characterized in that a second part of the masked plaintext block is generated. (26) The plaintext block includes first and second parts, the conversion means generating a first mask value from the second part using a first conversion; Generating a second mask value from the first part of the intermediate stage using a second transform using a second transform to combine the mask value of the first part with the first part to produce a first part of the intermediate stage. Means for combining the first mask value with the second portion to produce a masked second portion, and using a third transform from the masked second portion. Means for generating a third mask value and means for combining the third mask value with the first portion of the intermediate stage to generate a masked first portion, the masked portion A first portion of the masked plaintext block is generated using one of the Characterized in that by using the other second part of said masked plaintext block of disk portion is generated, according to the above (24). (27) A device for encrypting a plaintext block using a block encryption procedure, wherein the original plaintext block is defined to be recoverable from the masked plaintext block and optional additional data. Means for generating a masked plaintext block according to the plaintext block and optional additional data using a reversible transformation of, and at least a portion of the masked plaintext block using the encryption procedure. Means for encrypting to generate a ciphertext block, and for each encryption of the plaintext block, uniquely modifying at least one of the plaintext block and the optional additional data before generating the masked plaintext block A device including: (28) tangibly embodying a program of machine-executable instructions for performing the method steps of encrypting said plaintext data block using a block encryption procedure having a block size smaller than the plaintext block, A machine readable program storage device, wherein the method steps use a predetermined reversible transformation defined such that each bit of the masked plaintext block depends on each and every bit of the original plaintext block. And converting the plaintext block into the masked plaintext block, and encrypting a portion of the masked plaintext block having the block size using the encryption procedure to obtain the masked plaintext block. Generating an encrypted part of a plaintext block, said masked plaintext From the encrypted part of the lock and the remaining portion of said masked plaintext block and generating a ciphertext block, a program storage device. (29) A machine-executable program storage device tangibly embodying a program of machine-executable instructions for performing method steps of encrypting a plaintext block using a block encryption procedure. , The method steps use a predetermined lossless transform defined such that the original plaintext block is recoverable from the masked plaintext block and optional additional data,
Generating a masked plaintext block according to the plaintext block and any additional data; and encrypting at least a portion of the masked plaintext block using the encryption procedure to generate a ciphertext block. A program storage device comprising: a step of uniquely modifying at least one of the plaintext block and the optional additional data prior to generating the masked plaintext block for each encryption of the plaintext block. (30) A method for encrypting a plaintext block using a block encryption procedure, wherein a predetermined plaintext block is defined so that it can be restored from the masked plaintext block and optional additional data. Generating a masked plaintext block according to the plaintext block and the additional data using a lossless transformation of Generating a statement block.

[Brief description of drawings]

FIG. 1 is a schematic block diagram illustrating the encryption procedure of the present invention.

2 is a schematic block diagram showing a masking procedure used in the encryption procedure shown in FIG. 1. FIG.

3 is a schematic block diagram showing a first generator function used in the masking procedure shown in FIG. 2. FIG.

FIG. 4 is a schematic block diagram showing a second generator function used in the masking procedure shown in FIG.

FIG. 5 is a schematic block diagram showing a format of a key block.

FIG. 6 is a schematic block diagram showing the decoding procedure of the present invention.

7 is a schematic block diagram showing an unmasking procedure used in the decoding procedure shown in FIG.

FIG. 8 is a schematic block diagram showing a modified masking procedure using additional data outside the key block.

[Explanation of symbols]

 100 encryption procedure 110 key block 120 masking procedure 130 masked key block 140 encryption procedure 141 encryption key 150 ciphertext block 151 encrypted part

 ─────────────────────────────────────────────────── ———————————————————————————————————————————————————————————————————————————————————————————————— Photoucuc–us.com

Claims (30)

[Claims] 1. A method of encrypting a plaintext data block using a block encryption procedure having a block size smaller than a plaintext block, wherein each bit of the masked plaintext block is an original plaintext block. Transforming the plaintext block into the masked plaintext block using a predetermined lossless transform defined to be dependent on each and every bit of the block size using the encryption procedure. Encrypting a portion of the masked plaintext block having: to generate an encrypted portion of the masked plaintext block; and the encrypted portion of the masked plaintext block and the mask. Generating a ciphertext block from the rest of the generated plaintext block. 2. The method of claim 1, further comprising sending the ciphertext block to a recipient. 3. The method of claim 1, wherein the ciphertext block is generated by encrypting the rest of the masked plaintext block. 4. The encryption of the remaining portion of the masked block using an encryption procedure different from the encryption procedure used to encrypt the portion of the masked plaintext block. Method according to claim 3, characterized in that 5. The method of claim 1, wherein the plaintext block is generated without encrypting the rest of the masked plaintext block. 6. The method of claim 1, further comprising recovering an original plaintext block from the plaintext block. 7. The restoring step includes the step of regenerating the masked plaintext block from the plaintext block, and the regenerating step includes the step of decrypting the encrypted portion of the masked plaintext block. 7. The method of claim 6, wherein the decompressing step includes the step of reconstructing the original plaintext block from the reconstructed masked plaintext block by reversing the predetermined transformation. 8. The method of claim 1, wherein the encryption procedure comprises a symmetric encryption procedure having a public encryption key and a public decryption key. 9. Method according to claim 1, characterized in that the encryption procedure comprises an elliptic curve procedure. 10. The plaintext block includes first and second portions, and the transforming step masks the first portion with the second portion to obtain a first portion of an intermediate stage. Producing a masked second portion using the first portion of the intermediate step to produce a masked second portion, and using the masked second portion. And masking the first portion of the intermediate stage to produce a masked first portion, the first of the masked plaintext blocks using one of the masked portions. 2. The method of claim 1, wherein the second portion of the masked plaintext block is generated using the other of the masked portions. 11. At least one of the masking steps comprises concatenating one of the portions with additional data external to the key block to produce an extended portion; Masking the other of the two using the expanded portion. 12. The masked first portion forms the first portion of the masked plaintext block and the masked second portion of the second portion of the masked plaintext block. Method according to claim 10, characterized in that it forms a part. 13. The plaintext block includes first and second portions, the transforming step using a first transform to generate a first mask value from the second portion. Combining a first mask value with the first portion to produce an intermediate stage first portion; and using a second transformation to convert the intermediate stage first portion to a second mask value. Generating a masked second portion by combining the first mask value with the second portion, and using a third transform to generate the masked second portion. Generating a third mask value from the portion; and combining the third mask value with the first portion of the intermediate stage to generate a masked first portion. The masked flat surface using one of the The first part of a block is generated and the other of the masked parts is used to generate a second part of the masked plaintext block. Method. 14. The method of claim 13, wherein the mask value is generated using a one-way function. 15. The method of claim 13, wherein the combining step is performed by combining n-bit blocks using modulo addition. 16. The method of claim 15, wherein the combining step is performed using bitwise modulo-2 addition. 17. The masked plaintext block is generated in response to the plaintext block and optional additional data,
The method further comprises the step of uniquely modifying at least one of the plaintext block and optional additional data for each encryption of the plaintext block, the converting step being performed on the modified plaintext block. The method according to claim 1, characterized in that 18. A method of encrypting a plaintext block using a block encryption procedure, the original plaintext block being defined to be recoverable from the masked plaintext block and optional additional data. Generating a masked plaintext block according to the plaintext block and optional additional data using a predetermined reversible transformation, and using at least a portion of the masked plaintext block using the encryption procedure. And then encrypting to generate a ciphertext block, and for each encryption of the plaintext block, at least one of the plaintext block and the optional additional data is unique before the generation of the masked plaintext block. And a step of modifying. 19. The method of claim 18, wherein each plaintext block encryption uniquely modifies the plaintext block prior to the generation of the masked plaintext block. 20. The method of claim 18, wherein the additional data is uniquely modified prior to the generation of the masked plaintext block for each plaintext block encryption. 21. The method of claim 18, wherein the at least one of the plaintext block and the optional additional data comprises a count that increases with each encryption of the plaintext block. 22. The method of claim 18, wherein the at least one of the plaintext block and the optional additional data includes a different time stamp for each encryption of the plaintext block. 23. The method of claim 18, wherein the at least one of the plaintext block and the optional additional data includes a value randomly generated for each encryption of the plaintext block. Method. 24. An apparatus for encrypting a plaintext data block using a block encryption procedure having a block size smaller than the plaintext block, each bit of the masked plaintext block being the original plaintext block. Means for transforming the plaintext block into the masked plaintext block using a predetermined lossless transformation defined to depend on each and every bit of the block size of the block using the encryption procedure Means for encrypting a portion of the masked plaintext block to generate an encrypted portion of the masked plaintext block, and the encrypted portion of the masked plaintext block and the mask Means for generating a ciphertext block from the rest of the encrypted plaintext block. 25. The plaintext block includes first and second portions, and the converting means masks the first portion using the second portion to form a first portion of an intermediate stage. Means for generating, a means for masking the second portion using the first portion of the intermediate stage to generate a masked second portion, and using the masked second portion Means for masking the first portion of the intermediate stage to produce a masked first portion, the first of the masked plaintext blocks using one of the masked portions. 25. The apparatus of claim 24, wherein the second portion of the masked plaintext block is generated using the other of the masked portions. 26. The plaintext block includes first and second portions, the transforming means generating a first mask value from the second portion using a first transform; Means for combining a first mask value with the first portion to produce a first portion of the intermediate stage; and a second transform to use the second mask value from the first portion of the intermediate stage. Generating a masked second portion by combining the first mask value with the second portion to generate a masked second portion; Means for generating a third mask value from the portion, and means for combining the third mask value with the first portion of the intermediate stage to generate a masked first portion,
One of the masked portions is used to generate a first portion of the masked plaintext block and the other of the masked portions is used to generate a second portion of the masked plaintext block. 25. The device according to claim 24, characterized in that the parts are generated. 27. An apparatus for encrypting a plaintext block using a block encryption procedure, the original plaintext block being defined to be recoverable from the masked plaintext block and optional additional data. Means for generating a masked plaintext block according to the plaintext block and optional additional data using a predetermined reversible transformation, and using the encryption procedure for at least a portion of the masked plaintext block And encrypting each of the plaintext blocks to generate a ciphertext block by uniquely encrypting at least one of the plaintext block and the optional additional data before generating the masked plaintext block. And a means for modifying the device. 28. A tangible implementation of a program of machine-executable instructions for performing the method steps of encrypting a block of plaintext data using a block encryption procedure having a block size smaller than a plaintext block. A machine readable program storage device comprising: a predetermined reversible transformation defined such that each bit of the masked plaintext block depends on each and every bit of the original plaintext block. Transforming the plaintext block into the masked plaintext block using: and encrypting a portion of the masked plaintext block having the block size using the encryption procedure to obtain the mask. Generating an encrypted part of the encrypted plaintext block, said masked And and generating a ciphertext block from said encrypted part of the plaintext block with the rest of the masked plaintext block, a program storage device. 29. A machine-executable program storage device tangibly embodying a program of machine-executable instructions for performing the method steps of encrypting a plaintext block using a block encryption procedure. Wherein the method steps use a predetermined lossless transform defined such that the original plaintext block is recoverable from the masked plaintext block and optional additional data. Generating a masked plaintext block according to additional data; encrypting at least a portion of the masked plaintext block using the encryption procedure to generate a ciphertext block; The plaintext block and the arbitrary block before the generation of the masked plaintext block for each encryption. At least one of-option of additional data and correcting the specific program storage device. 30. A method of encrypting a plaintext block using a block encryption procedure, wherein an original plaintext block is defined so as to be recoverable from the masked plaintext block and optional additional data. Generating a masked plaintext block according to the plaintext block and additional data using a predetermined reversible transformation, and encrypting at least a part of the masked plaintext block using the encryption procedure. And generating a ciphertext block.